WorkOS directory sync webhooks need reconciliation after Okta group renames

Okta group renames can arrive through WorkOS directory sync as partial webhook events. If feature gates trust the payload, users split by cache state. Re-fetch the group and users before gating.